The Cybersecurity and Infrastructure Security Agency (CISA) has issued an Industrial Control Systems advisory regarding a vulnerability in Johnson Controls Simplex Incident Manager that stores user credentials in cleartext within system memory. Successful exploitation could allow a local attacker with low privileges to extract sensitive authentication data, potentially leading to unauthorized access to the application and connected systems. No known public exploitation has been reported at this time.

What should defenders do?

Upgrade Johnson Controls Simplex Incident Manager to version v2.01.01 or later. Restrict local access to authorized personnel only. Implement endpoint protection and monitoring to detect memory-dumping tools or suspicious processes. Enforce strong access control policies and the principle of least privilege on host systems. Utilize full-disk encryption and secure boot to reduce the risk of offline memory analysis. Monitor for unauthorized local access attempts and implement audit logging.

mediumVulnerability

CISA Warns of Credential Exposure in Johnson Controls Simplex Incident Manager

CVE-2026-27875 allows local extraction of passwords and tokens from memory

CyberIntel DeskPublished about 1 month agoUpdated less than a minute ago1 min read

Key Takeaways

CISA advisory ICSA-26-232-01 discloses CVE-2026-27875 in Johnson Controls Simplex Incident Manager.
The vulnerability allows local extraction of passwords and authentication tokens stored in cleartext within system memory.
Affected versions: Simplex Incident Manager <= V2.01.
Patch available: Johnson Controls Simplex Incident Manager v2.01.01 and later.
Exploitation requires local access, has high attack complexity, and no known public exploitation has been reported.

Related Security News

highVulnerability

Official MCP Python SDK Flaw Can Let Malicious Servers Steal OAuth Credentials

The maintainers of the official MCP Python SDK disclosed a security vulnerability that could allow a malicious server to trick applications into divulging OAuth credentials. The issue affects the handling of client secrets, authorization codes, and PKCE proof keys when communicating with token endpoints.

The Hacker Newsabout 4 hours ago1 min read

highCVE

CISA Adds Two Citrix NetScaler Vulnerabilities to Known Exploited Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. CVE-2026-88771 involves improper input validation and CVE-2026-88772 involves improper restriction of operations within the bounds of a memory buffer, both affecting Citrix NetScaler products. The additions trigger remediation requirements under Binding Operational Directive 26-04 for Federal Civilian Executive Branch agencies.

CISA Advisoriesabout 5 hours ago2 min read